CVE-2018-2677 is a partial denial-of-service vulnerability in the AWT subcomponent of Oracle Java SE and Java SE Embedded, affecting versions 6u171, 7u161, 8u152, 9.0.1, and 8u151 respectively. This easily exploitable flaw requires user interaction and network access for an unauthenticated attacker to compromise client-side Java deployments running untrusted code. With a CVSS 3.0 Base Score of 4.3 (Medium), its impact is limited to availability. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.6.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.6.0:update171:*:*:*:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update161:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update152:*:*:*:*:*:* | ||
9.0.1CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:9.0.1:*:*:*:*:*:*:* | ||
1.6.0CPE matchmatch criteria | cpe:2.3:a:oracle:jre:1.6.0:update171:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.